Home
» How to
»
How to enable Controlled Folder Access anti-ransomware feature on Windows 10/11
How to enable Controlled Folder Access anti-ransomware feature on Windows 10/11
Controlled Folder Access is a feature of Microsoft's Windows Security desktop antivirus application. It prevents ransomware by preventing files in protected folders from being modified. Enabling Controlled Folder Access prevents untrusted applications, malware, or other means from changing files in protected folders.
Controlled Folder Access is an additional security feature in Windows 10 and 11 that some users appreciate. Ransomware is not something to be taken lightly and enabling this feature will keep your system and user files extra safe. Here are 4 ways you can enable Controlled Folder Access in Windows.
How to enable Controlled Folder Access in Windows Security
The Controlled Folder Access setting is located under Ransomware Protection in the Windows Security app. It's easy to find and turn it on/off once you know where it is. Here's how to turn on Controlled Folder Access in the Windows Security app.
2. Select the Virus & threat protection tab of Windows Security.
Ransomware Protection feature
3. Click Manage ransomware protection to go to Controlled Folder Access settings.
Controlled Folder Access Options
4. Now, turn on the Controlled Folder Access option to enable that feature.
Controlled Folder Access protects the Documents, Videos, Pictures, and Music user folders when enabled. To see a list of protected user folders, click Protected folder. You can add more to the list by clicking the Add protected folder button , selecting a folder, and clicking Select Folder.
Add protected folder button
How to Enable Controlled Folder Access Using PowerShell
Windows PowerShell provides you with an alternative method to enable and disable Controlled Folder Access by executing commands. You can enable Controlled Folder Access using PowerShell as follows:
1. To activate the file search tool, press Win + S .
How to enable Controlled Folder Access with Group Policy Editor
If you have Windows 11 Pro or Enterprise, you can enable Controlled Folder Access using the Group Policy Editor. The Group Policy Editor also includes some additional configuration settings for Controlled Folder Access. Here's how to enable Controlled Folder Access via GPE.
Note : If you are using Windows Home, Group Policy Editor will not appear by default.
1. Open the Windows search tool and type gpedit.msc in it.
2. Select gpedit.msc to display the Group Policy Editor.
3. Click Computer Configuration > Administrative Templates in the left pane of Group Policy Editor.
Administrative Templates in Group Policy Editor
4. Double-click Windows Components to expand it.
5. Click the arrows to expand Microsoft Defender Antivirus and Microsoft Defender Exploit Guard .
6. Select Controlled Folder Access to view the policy settings for that feature.
7. Then double-click on Configure Controlled folder access to see that setting's window.
Policy Controlled Folder Access in Group Policy Editor
8. Select Enabled for the Configure Controlled folder access window .
9. Click Block on the drop-down menu to select the strictest CFA mode. However, you can also select the Audit Mode, Block disk notification only , and Audit disk notification only options to allow Controlled Folder Access.
Configure the guard my folders feature drop-down menu
10. Select Apply in the Configure Controlled folder access window .
11. Click the OK button of the Configure Controlled folder access window .
How to enable Controlled Folder Access from Windows context menu
Alternatively, you can create a context menu shortcut to enable/disable Controlled Folder Access. Then you will be able to access the Turn on Controlled folder access setting from the Windows desktop area. You can add such a CFA option to the right-click menu by setting up and running a registry script as follows:
1. Open Notepad.
2. Then select this script text and press Ctrl + C :
Windows Registry Editor Version 5.00
; Created by: Shawn Brink
; Created on: July 19th 2018
; Tutorial: https://www.tenforums.com/tutorials/114389-add-turn-off-controlled-folder-access-context-menu-windows-10-a.html
[HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess]
"HasLUAShield"=""
"Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"
"MUIVerb"="Turn On or Off Control folder access"
"Position"="Bottom"
"SubCommands"=""
[HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\001flyout]
"MUIVerb"="Turn on Control folder access"
"HasLUAShield"=""
"Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"
[HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\001flyout\command]
@="PowerShell -windowstyle hidden -Command \"Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Enabled' -Verb RunAs\""
[HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\002flyout]
"MUIVerb"="Turn off Control folder access"
"HasLUAShield"=""
"Icon"="%ProgramFiles%\\Windows Defender\\EppManifest.dll,-101"
[HKEY_CLASSES_ROOT\DesktopBackground\Shell\ControlledFolderAccess\shell\002flyout\command]
@="PowerShell -windowstyle hidden -Command \"Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Disabled' -Verb RunAs\""
3. Paste that script into Notepad by clicking on the application's window and pressing Ctrl + V .
Registry script to access Controlled Folder Access
4. Next, press Ctrl + Shift + S to view Notepad's Save as window .
5. Set the Save as type option to All files .
All files option
6. Type Turn on Control folder access.reg inside the file name box.
7. Choose to save the script to the desktop location.
8. Click Save to add the Turn on Control folder access registry file to the desktop.
9. Close the Notepad editor and double-click the Turn on Control folder access.reg file on the desktop.
Registry script confirmation dialog
10. Select Yes to confirm that you trust the script.
You can now enable Controlled Folder Access from the Windows context menu.